Hmmmm. Well, I see the problem, though it opens different questions... I'm using an HP 2600 series switch. I have 3 vlans, but no ports are tagged (they are all untagged). The monitoring/mirroring port is supposed to be on the same vlan as the port you are monitoring. It wasn't. When I used the filter "vlan and host 65.98.143.227" it worked. So then I got rid of it and capture filter and verified that indeed the packets were all being sent, but were tagged. Does that mean that all ports are sending out packets for all vlans but they're tagged, or it's sending tagged packets on the monitoring port even if it's not in the same vlan on the port being monitored?
Anyway, you answered my question! Thanks some much Sake! -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sake Blok Sent: 2007-11-15 19:14 To: Community support list for Wireshark Subject: Re: [Wireshark-users] Capture filter not working? On Thu, Nov 15, 2007 at 05:49:57PM -0800, Trevor Tolk wrote: > capture filter: > > host 65.98.143.227 Could it be that the frames coming from the mirrored port are vlan-tagged (if so, they have a [802.1q] header in the packet detail pane). If they are, you must use the capture filter "vlan and host 65.98.143.227" Hope this helps, Cheers, Sake _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users